SYSLOG (network event protocol) is an event delivery protocol widely used in various network operation systems, such as Microsoft Windows, Unix and Linux, etc.
The SYSLOG protocol works in a Client-Server mode for communication, and the Client is the sender while the Server is the receiver of an event message. The Client may be an event generator such as equipment or a procedure, and it also may be a relay entity which processes the SYSLOG event received from another sender (an event generator or other relay entities) and then sends the processed event to another receiver.
The SYSLOG protocol is a simplex communication protocol, that is, the event message is only sent from the sender to the receiver, and the receiver does not send any acknowledgement, “connect start”, “connect close” message or the like, i.e., the receiver never sends any message to the sender in the layer of SYSLOG protocol (however, bi-directional communication may be needed for the transport protocol in the lower layer).
The SYSLOG protocol is a text-based protocol in which all parameter names and parameter values are text, and uses of the characters with code value less than 32 in ASCII code are avoided, that is, uses of the control character are avoided. A SYSLOG message may be simply taken as a text block from the view of the lower layer transfer protocol.
At present, User Datagram Protocol (UDP) is generally used to transfer a SYSLOG message. As UDP is used to transfer a SYSLOG message, each UDP message can only transfer one SYSLOG message according to the relationship between the length of a SYSLOG message and that of a UDP message. The protocol stack for a UDP based SYSLOG message transfer is shown in part A of the schematic diagram of the SYSLOG protocol stack structure in FIG. 1.
However, UDP is an unreliable connectionless protocol in spite of its simplicity and flexibility. Losses may occur during message transfer based on UDP, and such matters as “packet loss” are not handled by the SYSLOG message, thus the loss of the event information may occur while the UDP is used to transfer a SYSLOG message. As a reliable connection-oriented protocol, a transfer control protocol (TCP) may be used to transfer the SYSLOG message so as to improve the reliability of data transfer. A protocol stack for a TCP-based SYSLOG message transfer is shown in part B of the schematic diagram of the SYSLOG protocol stack structure in FIG. 1.
At present, the Internet security is increasingly critical for stably running the network; similarly, the SYSLOG protocol also faces security problems as following:
1. information falsification: the SYSLOG message may be falsified by a malicious intermediate network node during transfer.
2. information leakage: the SYSLOG message may be intercepted illegally during transfer, and information in the SYSLOG message, such as the description information of an event, is taken.
3. identity spoofing: a malicious node imitating as a legal node participates in the communication of SYSLOG.
In order to solve the security problems of the SYSLOG message transfer, the SYSLOG message may be transferred over such secure protocols as Transport Layer Security protocol (TLS), BEEP (a TCP based secure protocol) and Secure SHell protocol (SSH), all of which can provide such safety mechanisms as privacy, integrity and data source verification so that the security problems of the SYSLOG message can be solved. A protocol stack for transferring the SYSLOG message based on TCP or secure protocols is shown in part C of the schematic diagram of SYSLOG protocol stack structure in FIG. 1.
When TCP or a secure protocol is used to transfer the SYSLOG message, the message that can be transferred may be long while a SYSLOG message is generally short. Therefore, a plurality of SYSLOG messages may be arranged in one TCP or secure protocol message so as to improve the transfer efficiency. When a receiver receives a transferred message, there may be a plurality of SYSLOG messages in the payload of the message (for secure protocol transfer, the payload has to undertake a secure protocol operation such as decipherment first). Therefore, the received message can only be properly processed by identifying the border of each SYSLOG message therein and parsing each SYSLOG message from the payload.
A method in a related art for parsing the SYSLOG messages from the payload is to add one or more special control characters to the end of each SYSLOG message. Since the SYSLOG protocol is a plain text protocol, and characters with ASCII code less than 32 are avoided in the contents of the message, the added special control character is usually a character whose code is less than 32 in ASCII, such as Carriage Return and Line Feed (CR and LF, whose codes are 13 and 10 in ACSII, respectively). When the receiver receives and processes the aforesaid SYSLOG message, once an aforesaid special character is found in the message, the SYSLOG message is considered to reach its end, and the beginning of another SYSLOG message is followed or the entire payload is ended (for the last record in the payload, the aforesaid special control character may not be added thereafter). Refer to FIG. 2 for the schematic diagram of adding one or more special control characters to the end of each SYSLOG message.
The aforesaid method has such drawbacks as large processing consumption and low processing speed, for the processing program should traverse all characters in the payload to detect the aforesaid special control character, so as to determine the beginning and end of each SYSLOG message.
Furthermore, errors in the parsing of the SYSLOG message may also occur according to the aforesaid method. For example, in a SYSLOG safety mechanism, a hash is created for each SYSLOG message by such a hash function as MD5 or SHA1, and all the hashes are put in the SYSLOG message. The SYSLOG message may also include other information. Then, signature is made for the SYSLOG message and put into the SYSLOG message, and then transferred to the receiver (a relay entity or a collection entity), and the receiver validates the identity of the SYSLOG sender according to the signature. In addition, the certificate for validating signature is also sent to the receiver via one or more SYSLOG messages.
The aforesaid hash, signature and part of the contents in a certificate sent to the receiver are all in the binary format, in which an aforesaid special control character may be included. In this situation, during the parsing of the SYSLOG message by the aforesaid method, special control characters in the hash, signature or certificate may be mistaken as the border of the SYSLOG message, thus errors in the parsing of the SYSLOG message may occur.
There is another possible method in another related art for parsing the SYSLOG message from the payload. In order to solve the aforesaid problem of mis-parsing the message due to the existence of the signature, the message may be analyzed orderly, that is, the message is analyzed from the beginning of the payload, and whenever a hash, signature or certificate is found, the end of them is determined according to such characteristics as length of hash, signature or certificate. For each cryptographic algorithm/hash algorithm has its specific characteristic length, which makes it possible to find the end of each binary data by length.